M0.13: make verified deployment runtime-neutral

[pgousdal]

Implements M0.13 runtime-neutral verification on top of the M0.11/M0.12 trust path.

Changes:

• replace Docker Buildx digest resolution in scripts/verify-release.sh with Skopeo;
• keep exact Cosign certificate identity and GitHub Actions OIDC issuer verification;
• add RUNTIME=auto|docker|podman for post-verification pulls;
• keep stdout machine-readable as the immutable verified image ref only;
• remove Docker as a requirement for verified Quadlet rendering;
• update deployment verification/enforcement workflows to use Skopeo;
• add real CI qualification for both Docker and Podman pull paths plus a fail-closed wrong-issuer test;
• document the M0.13 trust path and acceptance criteria.

The signed v0.2.3 release remains the immutable qualification target; no tag is moved or rewritten.